@zackbart/connecta 0.34.0 → 0.35.0

package/dist/providers/ccb/safety.js

@@ -0,0 +1,295 @@
+export const CCB_VALUE_SAFETY = {
+    "title": "CCB",
+    "operations": {
+        "PUT /events/{event_id}/attendance_grouping": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": [],
+        },
+        "PUT /events/{id}/invitation_settings": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": [],
+        },
+        "PUT /events/{id}/shared_campuses/{campus_id}": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": [],
+        },
+        "GET /individuals/background_checks": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": [],
+        },
+        "GET /individuals/{id}/background_checks": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": [],
+        },
+        "PUT /needs/{id}/coordinator": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": [],
+        },
+        "POST /oauth/token": {
+            "verdict": "refuse",
+            "reason": "OAuth token exchange and password reset belong to the connection grant or the vendor application.",
+        },
+        "POST /reset_password": {
+            "verdict": "refuse",
+            "reason": "OAuth token exchange and password reset belong to the connection grant or the vendor application.",
+        },
+        "PUT /scheduling/events/{event_id}/serving_rotations/{serving_rotation_id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["event_files[].url"],
+            "keep": [],
+        },
+        "GET /scheduling/songs/{song_id}": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": ["time_signature"],
+        },
+        "POST /search/songs/results": {
+            "verdict": "safe",
+            "reason": "Reviewed public names denote background-check records, event settings, serving rotations or musical metadata; no authentication credential is returned.",
+            "keep": ["[].song_keys", "[].time_signature"],
+        },
+        "POST /files": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["url"],
+            "keep": [],
+        },
+        "GET /files/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["url"],
+            "keep": [],
+        },
+        "GET /individuals/{id}/files": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].file.url"],
+            "keep": [],
+        },
+        "POST /individuals/{id}/files": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].file.url"],
+            "keep": [],
+        },
+        "POST /individuals/{id}/files/{file_id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].file.url"],
+            "keep": [],
+        },
+        "GET /forms/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["files[].url"],
+            "keep": [],
+        },
+        "GET /groups/{id}/messages": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].files.url", "[].recent_comments.files.url"],
+            "keep": [],
+        },
+        "GET /messages/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["files.url", "recent_comments.files.url"],
+            "keep": [],
+        },
+        "PUT /messages/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["files.url", "recent_comments.files.url"],
+            "keep": [],
+        },
+        "GET /messages/{id}/comments": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].files.url"],
+            "keep": [],
+        },
+        "POST /messages/{id}/comments": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["files.url"],
+            "keep": [],
+        },
+        "PUT /messages/{id}/comments/{comment_id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["files.url"],
+            "keep": [],
+        },
+        "GET /scheduling/categories/{id}/schedules": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].events[].event_files[].url"],
+            "keep": [],
+        },
+        "POST /scheduling/categories/{id}/schedules": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].events[].event_files[].url"],
+            "keep": [],
+        },
+        "POST /scheduling/categories/{id}/files": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["url"],
+            "keep": [],
+        },
+        "GET /scheduling/categories/{id}/events": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].event_files[].url"],
+            "keep": [],
+        },
+        "GET /scheduling/schedules/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["events[].event_files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/schedules/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["events[].event_files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/events/{event_id}/event_position_associated_times": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["event_files[].url"],
+            "keep": [],
+        },
+        "GET /scheduling/events/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["event_files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/events/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["event_files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/events/{id}/copy_assignments": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].event_files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/events/{id}/copy_assignments/{copyFromEventId}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["event_files[].url"],
+            "keep": [],
+        },
+        "POST /scheduling/events/{id}/files": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].url"],
+            "keep": [],
+        },
+        "GET /scheduling/categories/{id}/service_plans": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].items[].files[].url"],
+            "keep": [],
+        },
+        "POST /scheduling/categories/{id}/service_plans": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["items[].files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/service_plans/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].items[].files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/service_plans/{id}/items": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["items[].files[].url"],
+            "keep": [],
+        },
+        "POST /scheduling/service_plans/{id}/items": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["items[].files[].url"],
+            "keep": [],
+        },
+        "PUT /scheduling/service_plan_items/{id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["files[].url"],
+            "keep": [],
+        },
+        "GET /scheduling/individuals/{id}/open_event_positions/{event_position_id}": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["schedule.events[].event_files[].url"],
+            "keep": [],
+        },
+        "POST /search/assignments/results": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].schedule.events[].event_files[].url"],
+            "keep": [],
+        },
+        "POST /search/organizers/results": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].schedule.events[].event_files[].url"],
+            "keep": [],
+        },
+        "POST /search/schedules/results": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].events[].event_files[].url"],
+            "keep": [],
+        },
+        "POST /search/scheduling_files/results": {
+            "verdict": "redact",
+            "reason": "File destinations can be private bearer download links; withhold them regardless of URL signing spelling.",
+            "paths": ["[].url"],
+            "keep": [],
+        },
+    },
+    "fields": {
+        "calendar_ical": {
+            "verdict": "redact",
+            "reason": "Private calendar feed destination, never returned through configuration.",
+        },
+        "payment_url": {
+            "verdict": "redact",
+            "reason": "Payment-session destination may convey access; use the vendor application.",
+        },
+        "time_signature": {
+            "verdict": "keep",
+            "reason": "Musical time signature, not an authentication signature.",
+        },
+        "song_keys": {
+            "verdict": "keep",
+            "reason": "Musical song keys, not stored credentials.",
+        },
+        "access_token": {
+            "verdict": "redact",
+            "reason": "OAuth access credential is permanently withheld.",
+        },
+        "refresh_token": {
+            "verdict": "redact",
+            "reason": "OAuth refresh credential is permanently withheld.",
+        },
+    },
+};

package/dist/providers/ccb/skill.generated.js

@@ -1,9 +1,5 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "\n\n## Resolve ids before acting\n\n- Every record is addressed by an integer id. Read it from a list tool and\n  pass it back; never guess one. `list_individuals` finds people by partial\n  name, phone, or email; `familyId`, `groupId`, `eventId`, form, process,\n  queue, and category ids come from their own list tools.\n- Events are series with dated occurrences. `list_events` returns\n  `eventId` plus `occurrence`; the attendance tools need both.\n- Campus and membership-type ids resolve through `ccb_api_get` on\n  `/campuses` and `/church/membership_types`.\n\n## Sensitive data stays out of results\n\nProjections drop allergies, giving numbers and dates, attendance prayer\nrequests and leader notes, and form payment details; `raw: true` returns\nCCB's full row. Notes, pledges, giving metrics, background checks, and\nfinancial settings are pastoral or financial: read them inside\n`execute_code` and return only the reduced answer the task needs.\n\nGiving in v2 is counts per period (`get_giving_metrics`), pledges, scheduled\ngifts, and financial settings. Transactions, batches, and amounts per gift\nlive only in CCB's legacy v1 XML API, which this connector does not reach.\n\n## Paging\n\nLists take `page` (1-based) and `perPage` (25, 50, 75, or 100 only) and\nreturn `page.hasMore`, `page.nextPage`, and `page.total`. Field names are\nCCB's snake_case turned camelCase.\n\n## Rate limits\n\nCCB allows each endpoint about one call a second after a burst of 60, per API\nclient. This connector keeps a per-runtime 60-per-minute window per endpoint\n— an approximation, not an enforcement. `get_individual` (1/s),\n`list_schedules` (1 per 2 s), and individuals advanced search (1 per 5 s)\nallow no burst: page a list instead of looping a get, and space those calls.\nA `rate_limited` failure carries CCB's wait.\n\n## Raw access\n\n`ccb_api_get` reaches any GET path; `ccb_api_search` runs advanced searches,\nwhich CCB serves as POST but are reads.",
-    "instructionsHeading": "Church instructions",
-    "fragments": {
-        "guide_0": "\n\n## Resolve ids before acting\n\n- Every record is addressed by an integer id. Read it from a list tool and\n  pass it back; never guess one. `list_individuals` finds people by partial\n  name, phone, or email; `familyId`, `groupId`, `eventId`, form, process,\n  queue, and category ids come from their own list tools.\n- Events are series with dated occurrences. `list_events` returns\n  `eventId` plus `occurrence`; the attendance tools need both.\n- Campus and membership-type ids resolve through `ccb_api_get` on\n  `/campuses` and `/church/membership_types`.\n",
-        "guide_1": "\n## Sensitive data stays out of results\n\nProjections drop allergies, giving numbers and dates, attendance prayer\nrequests and leader notes, and form payment details; `raw: true` returns\nCCB's full row. Notes, pledges, giving metrics, background checks, and\nfinancial settings are pastoral or financial: read them inside\n`execute_code` and return only the reduced answer the task needs.\n\nGiving in v2 is counts per period (`get_giving_metrics`), pledges, scheduled\ngifts, and financial settings. Transactions, batches, and amounts per gift\nlive only in CCB's legacy v1 XML API, which this connector does not reach.\n\n## Paging\n\nLists take `page` (1-based) and `perPage` (25, 50, 75, or 100 only) and\nreturn `page.hasMore`, `page.nextPage`, and `page.total`. Field names are\nCCB's snake_case turned camelCase.\n\n## Rate limits\n\nCCB allows each endpoint about one call a second after a burst of 60, per API\nclient. This connector keeps a per-runtime 60-per-minute window per endpoint\n— an approximation, not an enforcement. `get_individual` (1/s),\n`list_schedules` (1 per 2 s), and individuals advanced search (1 per 5 s)\nallow no burst: page a list instead of looping a get, and space those calls.\nA `rate_limited` failure carries CCB's wait.\n\n## Raw access\n\n`ccb_api_get` reaches any GET path; `ccb_api_search` runs advanced searches,\nwhich CCB serves as POST but are reads."
-    }
+    "content": "## People, households and groups\n\nCCB v2 addresses records by integer ids. Resolve a person from the individual\nlist and a household from families; never guess ids. Family membership and\nchurch group membership join by individual id. A membership role belongs to\nthat group, rather than being a property of the person everywhere.\n\nIdentity Auth acts with the signed-in person's permissions. A permission\nrefusal can mean that person lacks access even when the connection is healthy.\n\n## Events and attendance\n\nAn event is a series; its dated occurrence is a separate identity. Attendance\njoins need both the event id and occurrence. Preserve the vendor's date and\ntime-zone meaning instead of treating every occurrence as UTC midnight.\n\n## Pastoral and financial records\n\nNotes, background checks, pledges and giving metrics can be sensitive. Read\nonly what the task needs and reduce those records inside execute_code before\nreturning an answer. Gift metrics are counts by period, with a range of at\nmost twelve months. Per-gift transactions and amounts belong to the legacy\nv1 XML API, which this v2 connector does not reach.\n\n## Vendor call rates and recovery\n\nCCB meters endpoints separately per API client. Individual profile reads have\nno burst; individual advanced searches allow one call per five seconds, and\ncategory schedule lists allow one per two seconds. Prefer list pages over a\nloop of individual gets. Other deployments sharing the client spend from the\nsame vendor allowance.\n\nFor a profile edit, resolve the individual first and preserve fields outside\nthe requested change. Use `ccb_api_write` for the edit; the host may ask the\nuser to confirm. After an ambiguous update, read that profile to determine\nwhat actually changed before deciding whether another write is needed.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `ccb_api_details`, `ccb_api_read`, `ccb_api_search`, `list_event_attendees`, `list_events`, `list_families`, `list_group_members`, `list_groups`, `list_individual_groups`, `list_individual_notes`, `list_individuals`, `search_records`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 25, at most 100). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `ccb_api_search` finds this API's operations and reads no account data, `ccb_api_details` shows one operation's contract, and `ccb_api_read` calls a reviewed read. `ccb_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused. 14 operations are refused by design; use `ccb_api_details` with the method and path to inspect the original operation summary and its separate refusal. Use details for refused methods outside the read/write call schemas; those methods remain unavailable.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. `not_found` means the record does not exist; this API tells absence from a permission gap. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "instructionsHeading": "Church instructions"
 };